A coding specialist in a group practice opens a neighbor’s electronic health record out of curiosity, with no assigned coding or billing duty for that patient. How should this access be classified?
Select an answer to reveal the explanation.
Short Explanation
Working at the clinic is not a backstage pass to every chart in town. If the job doesn’t need that neighbor’s record, peeking is snooping—plain unauthorized access. Curiosity doesn’t become compliance just because nobody edited the note.
Full Explanation
Workforce members may access PHI only as needed to perform assigned job functions under the minimum necessary standard and organizational access policies. Viewing a record without a treatment, payment, operations, or other permitted work purpose is unauthorized access, regardless of employment status or whether the record was altered. Practices typically investigate such events through privacy/security incident processes and may impose sanctions.